Authenticated worker stall via catastrophic regex backtracking

Regular-expression denial of service in Open WebUI 0.9.6 and later before 0.11.0 allows remote authenticated users to stall a worker. The build_matcher function compiles metacharacter-bearing chat patterns with Python's backtracking re engine, then grep_knowledge_files synchronously tests them against every reachable file line without a timeout. An ordinary account, one readable uploaded file, and a model that invokes the tool are sufficient; the affected worker blocks other users, and a default single-worker deployment loses the whole instance.